Zitadel Setup

ShiftIt uses Zitadel as its OIDC identity provider. Each ShiftIt tenant maps 1:1 to a Zitadel organisation.

First-time setup

Boot Zitadel (Docker Compose includes it; for binary deploys, install separately and point ShiftIt at it).
Create the ShiftIt application in your Zitadel admin console:
- Project: ShiftIt
- Application type: User Agent (PKCE)
- Redirect URIs: https://app.yourdomain.com/auth/callback
- Post-logout redirect URIs: https://app.yourdomain.com/
Copy the client_id into the frontend build env as ZITADEL_CLIENT_ID and the issuer URL as ZITADEL_AUTH_URL.

Per-tenant onboarding

Each customer organisation needs:

A new Zitadel Organisation created via the admin API.
The organisation’s org_id recorded — this is the zitadel_org_id column in ShiftIt’s tenants table. Insert a row in tenants with this id at onboarding time.
A Zitadel action that adds the shiftit_role claim to issued tokens. The role string ("admin" / "employee" / "customer") is read by ShiftIt’s auth middleware.

Custom claim mapping

ShiftIt expects two custom JWT claims:

urn:zitadel:iam:org:id — Zitadel adds this automatically for org-scoped tokens.
shiftit_role — added via a Zitadel action. Example action script:

function setShiftItRole(ctx, api) {
    const userMetadata = ctx.v1.user.metadata || {};
    const role = userMetadata.shiftit_role?.value || "employee";
    api.v1.claims.setClaim("shiftit_role", role);
}

Set per-user metadata shiftit_role to "admin" for admins; default is "employee".

Zitadel Setup

First-time setup

Per-tenant onboarding

Custom claim mapping

See Also